asyncrat | 8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c

General

Target
8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
Size 45KB
Sample260804-wcmt2see73
SHA256 8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c
MD5 ee0d3533b490ab298ee97071d84e4d90
SHA1 029512de15bd11349a481250e285142735b01be1
SHA512 12c19ecfd1dce6579cfe272fc758ee133b3cadc703d22437dd5623b245862dca6ca462458c6c45e9b0dede550beb1e15323763ef6e883d9240375d8a2b66bbbb
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVeBzCQKx7PImEjbBgX3iHx6jFzA1i9BDZkx:suJdpTPdI2/o0mEbuXS4jFzgKdkx
TLSH
T1D32319003BD8822BF2BE4FB898F26145467AF6637603D94D2CC451DB5A23FC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

xheovlvn.com:80
xheovlvn.com:22
xheovlvn.com:8080
xheovlvn.com:8880
xheovlvn.com:2052
xheovlvn.com:2082
xheovlvn.com:2086
xheovlvn.com:2095
xheovlvn.com:443
xheovlvn.com:2053
xheovlvn.com:2083
xheovlvn.com:2087
xheovlvn.com:2096
xheovlvn.com:8443
www.xheovlvn.com:80
www.xheovlvn.com:22
www.xheovlvn.com:8080
www.xheovlvn.com:8880
www.xheovlvn.com:2052
www.xheovlvn.com:2082
www.xheovlvn.com:2086
www.xheovlvn.com:2095
www.xheovlvn.com:443
www.xheovlvn.com:2053
www.xheovlvn.com:2083
www.xheovlvn.com:2087
www.xheovlvn.com:2096
www.xheovlvn.com:8443
mirai.xheovlvn.com:80
mirai.xheovlvn.com:22
mirai.xheovlvn.com:8080
mirai.xheovlvn.com:8880
mirai.xheovlvn.com:2052
mirai.xheovlvn.com:2082
mirai.xheovlvn.com:2086
mirai.xheovlvn.com:2095
mirai.xheovlvn.com:443
mirai.xheovlvn.com:2053
mirai.xheovlvn.com:2083
mirai.xheovlvn.com:2087
mirai.xheovlvn.com:2096
mirai.xheovlvn.com:8443
client.xheovlvn.com:80
client.xheovlvn.com:22
client.xheovlvn.com:8080
client.xheovlvn.com:8880
client.xheovlvn.com:2052
client.xheovlvn.com:2082
client.xheovlvn.com:2086
client.xheovlvn.com:2095
client.xheovlvn.com:443
client.xheovlvn.com:2053
client.xheovlvn.com:2083
client.xheovlvn.com:2087
client.xheovlvn.com:2096
client.xheovlvn.com:8443
azorult.xheovlvn.com:80
azorult.xheovlvn.com:22
azorult.xheovlvn.com:8080
azorult.xheovlvn.com:8880
azorult.xheovlvn.com:2052
azorult.xheovlvn.com:2082
azorult.xheovlvn.com:2086
azorult.xheovlvn.com:2095
azorult.xheovlvn.com:443
azorult.xheovlvn.com:2053
azorult.xheovlvn.com:2083
azorult.xheovlvn.com:2087
azorult.xheovlvn.com:2096
azorult.xheovlvn.com:8443

Mutex

bIgI56FsEG7G

Attributes

delay
0
install
true
install_file
q2wzom5d.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x000800000002458f-8.dat	family_asyncrat
behavioral1/memory/3944-10-0x00000000049C0000-0x00000000049D0000-memory.dmp	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe

Executes dropped EXE 2 IoCs

pid	Process
3944	q2wzom5d.exe
3420	q2wzom5d.exe

Outbound SSH connection to public host 2 TTPs 5 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc	pid	Process
SSH destination	71	172.67.146.62:22	3944	q2wzom5d.exe
SSH destination	85	104.21.81.197:22	3944	q2wzom5d.exe
SSH destination	98	172.67.146.62:22	3944	q2wzom5d.exe
SSH destination	29	172.67.146.62:22	3944	q2wzom5d.exe
SSH destination	55	104.21.81.197:22	3944	q2wzom5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5056	cmd.exe
4220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q2wzom5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q2wzom5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2756	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
Token: SeDebugPrivilege	3944	q2wzom5d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 5056	1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe	84
PID 1800 wrote to memory of 4220	1800	8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe	86
PID 4220 wrote to memory of 2756	4220	cmd.exe	88
PID 5056 wrote to memory of 2516	5056	cmd.exe	89
PID 4220 wrote to memory of 3420	4220	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe
"C:\Users\Admin\AppData\Local\Temp\8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "q2wzom5d" /tr '"C:\Users\Admin\AppData\Roaming\q2wzom5d.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "q2wzom5d" /tr '"C:\Users\Admin\AppData\Roaming\q2wzom5d.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp59D3.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2756
- - C:\Users\Admin\AppData\Roaming\q2wzom5d.exe
    "C:\Users\Admin\AppData\Roaming\q2wzom5d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3420

C:\Users\Admin\AppData\Roaming\q2wzom5d.exe
"C:\Users\Admin\AppData\Roaming\q2wzom5d.exe"
1⤵
- Executes dropped EXE
- Outbound SSH connection to public host
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

1

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp59D3.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp59D3.tmp.bat
Size 152B
SHA256 dc089b40748ca0f10649460265da71154ffb86bdb13331c63c4862dcf80db508
MD5 4b50123908e2a5986fd986e665899519
SHA1 ebf6d018f06c7575b23b9e1466648769f11bda04
SHA512 0a8ec220ee0f62ee37dadbfeb34e325c84b17e2fd1a76b7a61250a86457fc1af550c5d7af7d8f221b66c3a48c3de52ab114bd84e8468cbbdc363c1f4f3c426ff
TLSH
T199C02B4395C9EA0F2D06142302FBD99CB1B3AD5B3F80BB50C744404F2280858F4D9341
MD5 SHA1 SHA512 TLSH

Submit Download

q2wzom5d.exe

Path C:\Users\Admin\AppData\Roaming\q2wzom5d.exe
Size 45KB
SHA256 8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c
MD5 ee0d3533b490ab298ee97071d84e4d90
SHA1 029512de15bd11349a481250e285142735b01be1
SHA512 12c19ecfd1dce6579cfe272fc758ee133b3cadc703d22437dd5623b245862dca6ca462458c6c45e9b0dede550beb1e15323763ef6e883d9240375d8a2b66bbbb
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVeBzCQKx7PImEjbBgX3iHx6jFzA1i9BDZkx:suJdpTPdI2/o0mEbuXS4jFzgKdkx
TLSH
T1D32319003BD8822BF2BE4FB898F26145467AF6637603D94D2CC451DB5A23FC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-0-0x0000000000390000-0x00000000003A2000-memory.dmp

Download

memory/1800-1-0x0000000004D20000-0x0000000004D30000-memory.dmp

Download

memory/1800-2-0x0000000004C00000-0x0000000004C9C000-memory.dmp

Download

memory/3944-10-0x00000000049C0000-0x00000000049D0000-memory.dmp

Download

memory/3944-13-0x00000000049C0000-0x00000000049D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads